{"repo":"Life45/revhv","free":true,"listed":false,"github":"https://github.com/Life45/revhv","clone":"git clone https://github.com/Life45/revhv.git","description":"Type-2 Intel x86-64 hypervisor for Windows focused on tracing control-flow transitions out of obfuscated or virtualized kernel drivers at runtime with EPT","language":"C++","stars":11,"topics":["anti-cheat","driver-analysis","dynamic-analysis","ept","hypervisor","intel","kernel","reverse-engineering","tracing","windows"],"license":"MIT","category":"analytics","readme_excerpt":"revhv revhv is a type-2 Intel x86-64 hypervisor for modern Windows systems built to facilitate dynamic tracing of highly obfuscated or virtualized drivers where static analysis becomes too expensive or too blind. The tracing model is built around control-flow transitions between a monitored address range and the rest of the system by utilizing EPT. That means revhv can show which kernel APIs or other external code paths an obfuscated target actually reaches at runtime. The project is intentionally narrow. It is not trying to be a generic instruction tracer or a full introspection framework. The goal is to answer questions like: - Which kernel APIs does this protected driver actually reach at runtime? - What arguments/guest state such as registers were present at that boundary? For a longer walkthrough and a real analysis example, see the write-up: dynamic analysis with revhv. How tracing works revhv keeps two EPTP views per vCPU: - normal execution: target pages are non-executable - target execution: all non-target pages are non-executable Crossing the boundary between those views causes an EPT violation. revhv handles the VM-exit, flips the active EPTP, and resumes at the same RIP. A trace record is emitted for target execution - normal execution transitions. The same boundary concept can just as easily be used in reverse to uncover hooks or inbound control-flow into a region, although that is not the current implementation focus. Typical workflow 1. Start revhv-um and verif","default_branch":null,"files":null,"tree":[],"storefront":"/r/Life45","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/Life45/revhv/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}